Activity collectors
Activity collectors help you understand what users, agents, and non-human identities are doing with the access they have. These collectors aggregate access logs, audit events, system logs, and cloud logs, and load them into Identity Governance. They enable you to map system activity to user identities and identify abnormal activity, compliance violations, and shadow access, which exists in source systems but isn’t tracked by your Identity Governance system.
Activity log
The activity log is a standardized record that contains fields for authentication events and activity associated with agents, service accounts, other non-human identities, and access. It also has extension attributes that you can use to accommodate custom events.
The schema of the activity log is versioned to support backward compatibility. If you write custom field maps or integrations that rely on specific attributes, verify the schema version before loading data.
Three identifiers are relevant to activity log events:
-
id: The unique event ID -
actor_global_id: The identity, such as a non-human identity, workload, human, or agent -
actor_id: The actor’s local identifier within Identity Governance
Identity Governance correlates activity events from a source system based on actor_global_id and actor_id.
Available collectors
Activity collectors pull logs from the source systems where your identities operate. Identity Governance provides the following collectors:
-
AWS
-
Azure
-
Entra
-
Google Cloud
-
Google Workspace
-
Salesforce
-
JDBC
-
Windows
Each collector consists of:
-
Collector configuration: A
.jsonfile containing connectivity and other configuration parameters -
Field map: A
.jsonfile that maps the raw field names from the source system to the standard activity log attributes in Identity Governance
Learn more about deploying and using the collectors in the README.md file by downloading the IGA Collectors Zip.
Custom collectors
Use the activity collector toolkit, a Python-based tool that loads activity data and helps you build new collectors. You can create these additional collectors to read raw logs, transform them into a format that Identity Governance can ingest, and load the data with the toolkit.
If you don’t want to use the toolkit, use the REST API instead. Learn more in Identity Governance REST API reference.
Viewing activity data
After activity collectors load data into Identity Governance, you can review the activity log for individual accounts and AI Agents to investigate access events, detect anomalies, and confirm compliance.
To view activity data, go to the Accounts or AI Agents on the Advanced Identity Cloud admin console.
|
Viewing AI agent activity data requires the Agent Governance add-on capability. Contact your Ping Identity representative to enable it. |